Security Diva Meetup - May 2019

Fixing the Internet's Auto-Immune Problem: Bilateral Safe Harbor for Good-Faith Hackers

Thousands of organizations have already adopted the idea of inviting good-faith hacking to hack into their systems via vulnerability disclosure, bug bounty and next-gen pen test programs. Even so, the risk of prosecution under anti-hacking laws still casts a cloud over the hackers who are trying to help, and many programs haven't removed this risk by including Safe Harbor language within their program policies. It's not intentional -- the simple truth is that the market has progressed so rapidly that most have implemented crowdsourced security programs without realizing this issue, nor do they know how to how to fix it. Bilateral Safe Harbor language enables program owners to not only provide a strong incentive for good-faith hackers in terms of explicit legal protection, but also to outline exactly what constitutes "good-faith" hacking for their organization, and leave legal protections against malicious hackers intact.

This talk provides an overview of Safe Harbor in the context of good-faith hacking and introduces a current effort to create a standardized, open-source, easily readable legal boilerplate for disclosure program owners all around the world to use.

Founder at Global crypto events, former sales at Agari and SmartCloud Connect for Salesforce with a passion for security and helping others to stay safe in cyberspace. Having obtained a Master’s Degree in Finance, Julia worked in different business spheres such as finance, marketing, recruitment (L’Oreal, Raiffeisen bank, Neumann Partners) before landing in sales 4 years ago. In 2017 she moved to the US from Ukraine and discovered the world of cybersecurity at Agari email security company. During her work at Agari she worked with the best researchers in the space as well as attended numerous cybersecurity events and spoke with many companies about the most common cyber-attacks and how they can be prevented and stopped.

Implementation of DMARC as a way to protect the company’s brand and customers. True and false about DMARC implementation.

DMARC, which stands for “Domain-based Message Authentication, Reporting & Conformance”, is an email authentication, policy, and reporting protocol. It builds on the widely deployed SPF and DKIM protocols, adding linkage to the author (“From:”) domain name, published policies for recipient handling of authentication failures, and reporting from receivers to senders, to improve and monitor the protection of the domain from fraudulent email. Although almost everyone deals with DMARC on an everyday basis (while receiving and interacting with emails from the bank, PayPal, Amazon, etc.) only a few really understand what exactly DMARC does and what kind of attacks it CAN and CANNOT prevent. The talk will include a short history of DMARC, reasons for DMARC implementation as well as how much time and effort does it take to implement DMARC and whether this really worth it.

Navigating the Cybersecurity Policy and Legal Landscape

The world is getting more connected and the regulatory landscapes of cybersecurity are evolving. This talk will give practitioners and security researchers a quick intro to the variety of legal and regulatory concepts that govern the cybersecurity landscape focusing on recent trends, IoT and computer crime law. Highlights will include vulnerability disclosure, anti-hacking laws, and IoT security.